An analytics team discovers an S3 bucket policy unexpectedly allows a partner account full s3:* access, and security must identify the exposure scope and remove only the unintended grant without breaking legitimate analytics reads. Which remediation workflow corrects the excessive privilege accurately?

The correct workflow succeeds because IAM Access Analyzer for S3 correlates bucket policies, ACLs, and access points to surface exactly which external principals can access which resources, while policy checks and the s3: statement review show the grant exceeds actual analytics needs, and policy-level verification confirms effective permissions before the statement is narrowed to only required read actions, satisfying both scope identification and least-privilege remediation without disruption. By contrast, analyzing CloudTrail and access logs then deleting the whole partner principal correctly investigates activity but violates surgical remediation by revoking legitimate analytics reads along with the excess privilege, replacing least privilege with loss of access. Similarly, mapping exposure with Access Analyzer but then relying on S3 Block Public Access plus a blanket deny for s3: misunderstands control scope because Block Public Access does not remediate direct cross-account policy grants and a full deny again breaks required reads instead of restricting to them. Likewise, auditing CloudTrail history and policy versions with verification before restricting to analytics reads performs sound tightening but omits external-access scoping, so the team cannot prove which external identities or conditions were exposed for incident review. On the exam, distinguish scoping external exposure from merely reviewing usage history or blocking public access, as cross-account is not public. In practice, after tightening the policy re-run Access Analyzer to confirm zero unexpected external findings and test an analytics role can still list and get objects while the partner role cannot perform writes.